From 31106a073882656a2a5ab56c4ce2847e9a334c3c Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 28 Sep 2016 10:15:34 +0200 Subject: [PATCH] aprintf: detect wrap-around when growing allocation On 32bit systems we could otherwise wrap around after 2GB and allocate 0 bytes and crash. CVE-2016-8618 Bug: https://curl.haxx.se/docs/adv_20161102D.html Reported-by: Cure53 Upstream-Status: Backport https://curl.haxx.se/CVE-2016-8618.patch CVE: CVE-2016-8618 Signed-off-by: Thiruvadi Rajaraman --- lib/mprintf.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) Index: curl-7.44.0/lib/mprintf.c =================================================================== --- curl-7.44.0.orig/lib/mprintf.c +++ curl-7.44.0/lib/mprintf.c @@ -1011,16 +1011,19 @@ static int alloc_addbyter(int output, FI infop->len =0; } else if(infop->len+1 >= infop->alloc) { - char *newptr; + char *newptr = NULL; + size_t newsize = infop->alloc*2; - newptr = realloc(infop->buffer, infop->alloc*2); + /* detect wrap-around or other overflow problems */ + if(newsize > infop->alloc) + newptr = realloc(infop->buffer, newsize); if(!newptr) { infop->fail = 1; return -1; /* fail */ } infop->buffer = newptr; - infop->alloc *= 2; + infop->alloc = newsize; } infop->buffer[ infop->len ] = outc;